In the context of diagnosing IPsec cloud connectivity issues, what command is crucial for checking IPsec tunnel status on a Cisco IOS XE router?

Question

Options

• Ashow crypto ipsec sa
• Bshow crypto map
• Cshow version
• Dshow interfaces

• A
  88% (15)
• B
  6% (1)
• D
  6% (1)

Explanation

show crypto ipsec sa (option A) is the definitive command for diagnosing IPsec tunnel status because it displays Security Associations (SAs) - the active negotiated sessions that make up an IPsec tunnel - including packet counters, encryption algorithms, and encapsulation statistics that directly reveal whether traffic is flowing or where the failure lies.

Why the distractors are wrong:

• B. show crypto map shows the configuration of crypto maps (what policies are defined), not the real-time tunnel state - useful for config verification, not live diagnosis.
• C. show version displays IOS software version and hardware info - entirely unrelated to IPsec troubleshooting.
• D. show interfaces reports Layer 2/3 interface statistics like line protocol status, but provides no IPsec-specific information such as SA establishment or encrypted packet counts.

Memory tip: Think of SA = "Session Active." show crypto ipsec sa tells you if your IPsec sessions are active and counting packets. If the counters (#pkts encaps, #pkts encrypt) are incrementing, traffic is flowing through the tunnel - zero counters means something is broken.

No community discussion yet for this question.